How to Change DNS on Microsoft Azure & Entra ID

By [FILL IN], [FILL IN] · Last updated 2026-10-03

Entra ID (formerly Azure AD) is an identity service and has no DNS settings of its own. DNS for Azure workloads is configured on the virtual network (VNet), on domain controllers running in Azure, on Microsoft Entra Domain Services, or through Azure DNS Private Resolver. Pick the scenario that matches your setup.

Step by step

1. Find the public outbound IP of your Azure resources (NAT Gateway, Azure Firewall or VM public IP) and register it in the FirewallDNS dashboard.
2. Scenario A, VMs without AD: open Virtual networks > your VNet > DNS servers, choose Custom and enter <FIREWALLDNS-PRIMARY> and <FIREWALLDNS-SECONDARY>. Save, then restart the VMs (or renew DHCP) to pick up the change.
3. Scenario B, domain controllers in Azure: keep the VNet DNS servers pointing to the DC private IPs. On each DC, set the DNS forwarders to FirewallDNS exactly as in the Active Directory guide.
4. Scenario C, Microsoft Entra Domain Services: the managed DCs forward to Azure DNS and cannot be changed in the portal. From a domain-joined management VM with RSAT, open DNS Manager, connect to the managed domain and change Forwarders to FirewallDNS (members of AAD DC Administrators have this right).
5. Scenario D, Azure DNS Private Resolver: create an outbound endpoint, then a DNS forwarding ruleset with a wildcard rule for "." pointing to <FIREWALLDNS-PRIMARY> and <FIREWALLDNS-SECONDARY> on port 53. Link the ruleset to your VNets. Add more specific rules for privatelink and internal zones first.
6. If you use Azure Firewall as DNS proxy: Firewall Policy > DNS > Custom DNS servers, add the FirewallDNS addresses and enable DNS proxy.
7. Verify from a VM: nslookup example.com and check the live log in the FirewallDNS dashboard.

# Scenario A: set custom DNS on a VNet
az network vnet update -g MyRG -n MyVNet --dns-servers <FIREWALLDNS-PRIMARY> <FIREWALLDNS-SECONDARY>

# Scenario D: Private Resolver wildcard forwarding rule
az dns-resolver forwarding-rule create -g MyRG \
  --ruleset-name MyRuleset --name all-internet \
  --domain-name "." --forwarding-rule-state Enabled \
  --target-dns-servers '[{"ip-address":"<FIREWALLDNS-PRIMARY>","port":53},{"ip-address":"<FIREWALLDNS-SECONDARY>","port":53}]'